Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-15 21:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Switch file UID hashing from md5 to highwayhash.

Browse source 
This commit switches UID hashing from md5 to a highway hash. It also
moves the salt value out of the file plugin - and makes it
installation-specific instead - it is moved to the global namespace.

There now are digest hash functions to make "static"
installation-specific hashes that are stable over workers available to
everyone; hashes can be 64, 128 or 256 bits in size.

Due to the fact that we switch the file hashing algorithm, all file
hashes change.

The underlyigng algorithm that is used for hashing is highwayhash-128,
which is significantly faster than md5.
This commit is contained in:
Johanna Amann 2020-04-30 10:03:56 -07:00
parent bc546634d1
commit 3bce313b12
153 changed files with 953 additions and 799 deletions
Download patch file Download diff file Expand all files Collapse all files

6
testing/btest/Baseline/scripts.base.protocols.smb.smb2/files.log
View file

@ -3,8 +3,8 @@
#empty_field (empty)
#unset_field -
#path files
#open 2017-01-25-07-05-17
#open 2020-04-30-00-47-29
#fields ts fuid tx_hosts rx_hosts conn_uids source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid md5 sha1 sha256 extracted extracted_cutoff extracted_size
#types time string set[addr] set[addr] set[string] string count set[string] string string interval bool bool count count count count bool string string string string string bool count
1323202695.515890 Fg6wjp3BAYahIGAEf7 10.0.0.11 10.0.0.12 CHhAvVGS1DHFjwGM9 SMB 0 (empty) application/pdf WP_SMBPlugin.pdf 0.073970 - T 1508939 - 0 0 F - - - - - - -
#close 2017-01-25-07-05-17
1323202695.515890 FlZWcY3zsKh9Tt1Jy9 10.0.0.11 10.0.0.12 CHhAvVGS1DHFjwGM9 SMB 0 (empty) application/pdf WP_SMBPlugin.pdf 0.073970 - T 1508939 - 0 0 F - - - - - - -
#close 2020-04-30-00-47-29

8
testing/btest/Baseline/scripts.base.protocols.smb.smb2/smb_files.log
View file

@ -3,10 +3,10 @@
#empty_field (empty)
#unset_field -
#path smb_files
#open 2016-08-05-15-39-05
#open 2020-04-30-00-47-29
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid action path name size prev_name times.modified times.accessed times.created times.changed
#types time string addr port addr port string enum string string count string time time time time
1323202695.377459 CHhAvVGS1DHFjwGM9 10.0.0.11 49208 10.0.0.12 445 - SMB::FILE_OPEN \\\\10.0.0.12\\smb2 <share_root> 8192 - 1323202604.512058 1323202604.512058 1322343963.945297 1323202604.512058
1323202695.432192 CHhAvVGS1DHFjwGM9 10.0.0.11 49208 10.0.0.12 445 - SMB::FILE_OPEN \\\\10.0.0.12\\smb2 WP_SMBPlugin.pdf 0 - 1323202695.427034 1323202695.427034 1323202695.427034 1323202695.427034
1323202695.599914 CHhAvVGS1DHFjwGM9 10.0.0.11 49208 10.0.0.12 445 - SMB::FILE_OPEN \\\\10.0.0.12\\smb2 <share_root> 8192 - 1323202695.427034 1323202695.427034 1322343963.945297 1323202695.427034
#close 2016-08-05-15-39-06
1323202695.432192 CHhAvVGS1DHFjwGM9 10.0.0.11 49208 10.0.0.12 445 - SMB::FILE_OPEN \\\\10.0.0.12\\smb2 WP_SMBPlugin.pdf 0 - 1323202695.427036 1323202695.427036 1323202695.427036 1323202695.427036
1323202695.599914 CHhAvVGS1DHFjwGM9 10.0.0.11 49208 10.0.0.12 445 - SMB::FILE_OPEN \\\\10.0.0.12\\smb2 <share_root> 8192 - 1323202695.427036 1323202695.427036 1322343963.945297 1323202695.427036
#close 2020-04-30-00-47-29

4
testing/btest/Baseline/scripts.base.protocols.smb.smb2/smb_mapping.log
View file

@ -3,9 +3,9 @@
#empty_field (empty)
#unset_field -
#path smb_mapping
#open 2016-08-05-15-39-05
#open 2020-04-30-00-47-29
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p path service native_file_system share_type
#types time string addr port addr port string string string string
1323202695.377084 CHhAvVGS1DHFjwGM9 10.0.0.11 49208 10.0.0.12 445 \\\\10.0.0.12\\smb2 - - DISK
1323202695.378188 CHhAvVGS1DHFjwGM9 10.0.0.11 49208 10.0.0.12 445 \\\\10.0.0.12\\IPC$ - - PIPE
#close 2016-08-05-15-39-06
#close 2020-04-30-00-47-29